PhpSpreadsheet EUVD-2026-108264

Exploitation requires a non-default configuration: the consuming application must call setAllowExternalImages(true) (default is false in BaseReader) AND typically a setIsWhitelisted callback must be in place, which the attacker's redirecting host must pass. The attacker must control, or be able to induce, a whitelisted image host to return an HTTP 302 Location redirect to the chosen internal target (e.g., 169.254.169.254 cloud metadata), and the victim application must load an attacker-supplied xlsx/ODS file or HTML (via Reader\Html) containing an external-image relationship. Limiting factors: the external-image feature is off by default; the whitelist must permit the attacker's redirecting host; and the primitive is blind - only redirect-following and reachability/GET-triggering is possible since the response body is image-validated and the temp file is unlinked, so no data is exfiltrated.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The signals are internally consistent: CVSS 3.1 base 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and the vuln.today decision label of 'this_month' both place it in the patch-on-normal-cadence tier. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified' in the strict sense, though the GHSA advisory does contain a detailed proof-of-concept writeup (a public PoC reference exists; it is not verified as working exploit code). The real-world severity is tempered by two facts the raw CVSS does not capture: the vulnerable code path is gated behind a non-default opt-in (setAllowExternalImages(true), default false) plus an operator-supplied whitelist, and the primitive is a BLIND GET - the HTTP response body is never returned to the attacker because the reader validates content as an image and unlinks the temp file. Note a data conflict worth flagging: the NVD CWE is CWE-863 (improper authorization) and the input tags say 'Authentication Bypass', but the vendor advisory classifies this as SSRF (CWE-918) via a redirect-based whitelist bypass - the SSRF framing is the accurate one. Net: a legitimate server-side request forgery weakness in a popular library, meriting prompt patching where external images are enabled, but lower real-world urgency than the headline network-vector score suggests because of the non-default configuration requirement and blind nature.

An application that loads user-supplied spreadsheets with external image loading enabled (setAllowExternalImages(true)) and a host whitelist is fed a crafted xlsx whose drawing relationship points to an attacker-controlled but whitelisted host. That host answers the server's image fetch with an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/ (or another internal endpoint); because the stream context omits follow_location=0, PHP follows the redirect with no re-validation, forcing a blind server-side GET to the internal target. A detailed PoC is published in the GHSA advisory (public PoC reference; not verified as working exploit code).